Monday 27 June 2011 04.18 EDT
First published on Monday 27 June 2011 04.18 EDT

The abrupt decision of LulzSec to disband – or, at least, to appear to disband – may have caught some people by surprise: was it like a band breaking up at the peak of its powers? Its final pronouncements were gnomic as usual, linking to a Pastebin page in which it announced it was ending after 50 days (which implies that it began on the weekend of 7-8 May with the hack of Fox.com for the X Factor US contestants' database) and a torrent which turned out to be virus-infected.

For those who read it, the 457MB download included internal data from AOL and AT&T and what are claimed to be FBI documents.

The reality is that LulzSec was running out of time – and targets. As the Guardian revealed on Friday, it was a small group of between six and 10 people, with a clear leader (Sabu) and enforcer (Kayla), with a number of hangers-on.

The problem for LulzSec was that, being a small group, its targets and skills were naturally limited. The members didn't have any agenda beyond having some fun with hacking and becoming notorious for it, and so they set themselves to that.

But their decision to target games companies – EVE Online, Sony – made them enormously unpopular with other hackers, who don't like having their recreations taken away. Sony had closed down the PlayStation Network; then Nintendo was hit. There wasn't much for other hackers to do except try to find out who LulzSec actually were.

Meanwhile, the group upped the stakes, hitting Infragard, a company affiliated with the FBI. (This was the point where two of the members announced to Sabu that they didn't have the stomach for it.) And then it announced it had found weaknesses in the NHS's systems. It hit the US Senate.

For a small group, it's easy to run out of steam: what's the agenda? How do you keep it moving? What do you do when you start to exhaust your list of easy targets? Most hackers build up a list of potential targets over time, noting websites that they can probe and get inside and keeping them for later. Finding targets takes time; the more of you in the group and the more skilled you are – and the more carefully you time your releases – the easier it is to keep up a constant stream. Hack a lot of sites in short order and you quickly run out of low-hanging fruit, and you're on to the harder ones.

That also means that it's impossible to keep up an agenda, because you have to go with whatever site you find with a weakness, not sites or companies that fit any agenda. LulzSec was thus running out of fuel. (Compare it to the number of targets that Anonymous, with a tighter agenda, hits.)

Meanwhile, with more and more attention being paid to the group – by the media, law enforcement and other hackers seeking to get "dox" (real-life identity information) on them – the pressure both to do ever-greater acts and at the same time not to get caught became greater and greater.

Note that LulzSec didn't have much, if any, respect from other hacking groups. Anonymous didn't refer to it. Hackers I've contacted who had been inside and outside Anonymous were universally dismissive. The LulzSec hackers didn't have any friends, which is never useful.

So corralled by the external pressure of people wanting them to do ever more dramatic things, a media that was getting closer to it, and hackers who wanted to out them, allied to a dwindling list of ready-made targets, there wasn't any choice. Breaking up – more correctly, ceasing to operate under the LulzSec banner (since the group can get together any time that they come together in an IRC channel – became the obvious, safest move.

And that's what happened. It won't stop the hacking by smaller groups, but it may reduce the visibility of the activity, for some time. As Paul Carr noted: "It's no coincidence that so many of these hacker collectives appear towards the end of the academic year."

It could be a long summer. When's the last time you had a pen test on your company's systems? Might be time to check that again.